Processing of data packets within a network element cluster

• US 20020097724A1
• Filed: 10/19/2001
• Published: 07/25/2002
• Est. Priority Date: 01/09/2001
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Stonesoft Oy (Rtx Corporation)
• Inventors: Virtanen, Timo, Harjulahti, Esa, Halme, Matti, Syvanne, Tuomo, Virtanen, Tommi
• Granted Patent: US 7,280,540 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In a network element cluster having a plurality of nodes distribution decisions are determined (255) on the basis of certain field(s) of data packets according to predetermined criteria, and data packets are distributed (251) to nodes of the network element cluster according to the distribution decisions. Data packets are processed (252) said nodes of the network element cluster, and the processing involves selecting (253) at least partly arbitrary value(s) for at least one of the field(s) of at least one data packet. Such value(s) are selected (256) for at least one of said certain field(s) of a third data packet, that distribution decisions determined according to the predetermined criteria for a plurality of first data packets and a plurality of second data packets are the same, said pluralities of first and second data packets belonging to a first set of data packets and said third data packet being related to said first set of data packets.

Claims

1. A method for processing data packets within a network element cluster having a plurality of nodes, said method comprising the steps of:

determining (255) distribution decisions on the basis of certain field(s) of data packets according to predetermined criteria,

distributing (251) said data packets to nodes of the network element cluster according to the distribution decisions, and

processing (252) data packets in said nodes of the network element cluster, the processing involving a step of selecting (253) at least partly arbitrary value(s) for at least one of said certain field(s) of at least one data packet, characterized in that it further comprises the step of;

selecting (256) such value(s) for at least one of said certain field(s) of a third data packet, that distribution decisions determined according to the predetermined criteria for a plurality of first data packets and a plurality of second data packets are the same, said pluralities of first and second data packets belonging to a first set of data packets and said third data packet being related to said first set of data packets.

2. A method according to claim 1, characterized in that it further comprises the steps of:

selecting (257) at least partly arbitrary value(s) for at least one of said certain field(s) of a sixth data packet, thereby obtaining selected value(s), and

adjusting (258) said predetermined criteria on the basis of the selected value(s) so that said a plurality of fourth data packets and a plurality of fifth data packets result in the same distribution decision, said pluralities of fourth and fifth data packets belonging to a second set of data packets and said sixth data packet being related to said second set of data packets.

3. A method according to claim 2, characterized in that the sixth data packet is one of the fourth data packets and in that said sixth data packet and said pluralities of fourth and fifth data packets are processed in the same node of the network element cluster.

4. A method according to claim 2, characterized in that said sixth data packet is processed in a third node of the network element cluster and said pluralities of fourth and fifth data packets are processed in a fourth node of the network element cluster.

5. A method according to claim 1, characterized in that the third data packet is one of the first data packets and in that said third data packet and said pluralities of first and second data packets are processed in the same node of the network element cluster.

6. A method according to claim 1, characterized in that said third data packet is processed in a first node of the network element cluster and said pluralities of first and second data packets are processed in a second node of the network element cluster.

7. A method according to claim 1, characterized in that said certain fields comprise the source address field (202) and the destination address field (203) of an Internet Protocol header (201).

8. A method according to claim 7, characterized in that said certain fields further comprise port header fields of a Transmission Control Protocol header.

9. A method according to claim 7, characterized in that said certain fields further comprise port header fields of a User Datagram Protocol header.

10. A method according to claim 7, characterized in that said certain fields further comprise the identifier header field of an Internet Control Message Protocol.

11. A method according to claim 1, characterized in that said certain field(s) comprise a Message Identifier field (232) of an Internet Security Association and Key Management Protocol header (231).

12. A method according to claim 1, characterized in that said certain field(s) comprise an Initiator Cookie field (233) of an Internet Security Association and Key Management Protocol header (231).

13. A method according to claim 1, characterized in that said certain field(s) comprise the Security Parameter Index field (212) of a security header (211) relating to the IPSec protocol suite.

14. A method according to claim 1, characterized in that said certain field(s) comprise a Session ID field relating to the Secure Sockets Layer protocol.

15. A method according to claim 1, characterized in that said certain field(s) comprise an HTTP Cookie field relating to the HyperText Transfer Protocol.

16. A method according to claim 1, characterized in that said pluralities of first and second data packets are data packets of one communication connection, said first and second data packets being destined to the opposite directions within the communication connection.

17. A method according to claim 1, characterized in that said pluralities of first and second data packets are data packets of a first and a second communication connection of one communication session.

18. A method according to claim 1, characterized in that it further comprises

allocating (603) to each node belonging to said network element cluster certain node-specific hash values, each node having separate node-specific hash values allocated to it and said node-specific hash values forming a range of hash values, and

the steps of determining (250, 255) distribution decisions and distributing (251) said data packets comprise

processing (310) at least a plurality of data packets so that a data packet is processed in that node of said network element cluster, to which node a hash value calculated using certain header field(s) of said data packet is allocated.

19. A method according to claim 18, characterized in that it further comprises

defining (602) a first hash function for calculating at least for a first data packet, which is a data packet to be secured in said network element cluster in accordance with a protocol suite for securing packet data communications, a hash value using certain first header field(s) of the first data packet,

defining (602) a second hash function for calculating a hash value for a second data packet, which is a data packet of a secure tunnel in accordance with said protocol suite, using at least second header field(s) of the second data packet, and

the step of selecting (256) comprises

when establishing (500) a secure tunnel in accordance with said protocol suite, selecting (505) such value(s) for said second header field(s) that a hash value produced by said second hash function for a plurality of second data packets, said plurality of second data packets being data packets of said secure tunnel, is equal to a hash value produced by said first hash function for a plurality of first data packets, said plurality of first data packets being data packets to be protected using said secure tunnel.

20. A method according to claim 19, characterized in that a separate secure tunnel in accordance with said protocol suite is established at least for each separate hash value calculated using said first header field(s).

21. A method according to claim 19, characterized in that a separate secure tunnel in accordance with said protocol suite is established for each separate value of first header field(s).

22. A method according to claim 19, characterized in that said protocol suite is the IPSec protocol suite and said second header fields are the Security Parameter Index field (212) of a security header (211) relating to the IPSec protocol suite.

23. A method according to claim 19, characterized in that it further comprises the step of recognizing (304, 306) a second data packet among data packets by checking the value of the a Protocol field in a data packet, which is a data packet in accordance with Internet Protocol Version 4.

24. A method according to claim 19, characterized in that it further comprises the step of recognizing (304, 306) a second data packet among data packets by checking the value of the a Next Header field in a data packet, which is a data packet in accordance with Internet Protocol Version 6.

25. A method according to claim 19, characterized in that said protocol suite is the IPSec protocol suite.

26. A method according to claim 19, characterized in that it further comprises

defining (602) a third hash function for calculating a hash value for a third data packet, which is a data packet in accordance with a protocol for establishing a secure tunnel, using at least third header field(s), and

the step of selecting (256) further comprises

when initiating a message sequence in accordance with the protocol for establishing a secure tunnel in a node belonging to said network element cluster, selecting (502, 503) such value(s) for said third header field(s) in a third data packet belonging to said message sequence that a hash value produced by said third hash function is allocated to said node.

27. A method according to claim 26, characterized in that said protocol for establishing a secure tunnel is the Internet Key Exchange Phase II protocol, and said third header field(s) comprise a Message Identifier field (232) of an Internet Security Association and Key Management Protocol header (231).

28. A method according to claim 26, characterized in that said protocol suite is the IPSec protocol suite, a secure tunnel in accordance with the IPSec protocol suite is established using a message sequence in accordance with the Internet Key Exchange Phase II protocol.

29. A method according to claim 26, characterized in that said second and third hash functions are identical hash functions.

30. A method according to claim 26, characterized in that it further comprises

defining (602) a fourth hash function for calculating a hash value for a fourth data packet, which is a data packet in accordance with a protocol for establishing secure key management sessions, using at least fourth header field(s), and

the step of selecting (256) further comprises

when initiating a second message sequence in accordance with said protocol for establishing secure key management sessions in a node belonging to said network element cluster, selecting (402, 403) such value(s) for said fourth header field(s) in a fourth data packet, which is a data packet in accordance with said protocol for establishing secure key management sessions and belongs to said second message sequence, that a hash value produced by said fourth hash function is allocated to said node.

31. A method according to claim 30, characterized in that said protocol for establishing secure key management sessions is the Internet Key Exchange Phase I protocol and said fourth header field(s) comprise an Initiator Cookie field (233) of an Internet Security Association and Key Management Protocol header (231).

32. A method according to claim 18, characterized in that it further comprises the steps of:

monitoring (604) the state of nodes belonging to the network element cluster, and

reallocating (606, 607) the range of hash values to nodes belonging to the network element cluster based on the state of the nodes.

33. A method according to claim 32, characterized in that it further comprises the steps of:

after reallocation of hash values, checking (702) if there are established secure tunnels relating to reallocated hash values,

deleting (705) a secure tunnel relating to a reallocated hash value, and

establishing (400) a new secure tunnel to replace the deleted secure tunnel.

34. A method according to claim 18, characterized in that it further comprises

defining (602) a hash function for calculating a hash value for a data packet, which is a data packet in accordance with a key exchange protocol, using at least certain header field(s) of said data packet, and

the step of selecting (256) comprises

when initiating in a node a communication session in accordance with said key exchange protocol, selecting (402, 403, 502, 503) such value(s) for said header field(s) that a hash value produced by said hash function for a data packet relating to a said communication session is equal to one of the hash values allocated for said node.

35. A method according to claim 34, characterized in that said key exchange protocol is the Internet Key Exchange protocol, the communication session is an IKE Phase I negotiation and the header field is an Initiator Cookie field (233) of an Internet Security Association and Key Management header (231).

36. A method according to claim 34, characterized in that said key exchange protocol is the Internet Key Exchange protocol, the communication session is an IKE Phase II negotiation and the header field is a Message Identifier field (232) of an Internet Security Association and Key Management header (231).

37. A method according to claim 18, characterized in that it further comprises

defining (602) a hash function for calculating at least for a data packet a hash value using certain header field(s) of said data packet, said data packet being subject to a Network Address Translation procedure in the network element cluster and the Network Address Translation procedure concerning modification of at least one of said certain header field(s), and

the step of selecting (256) comprises

when carrying out the Network Address Translation procedure for a first data packet, selecting (256) such value(s) for at least one of said certain header field(s) that a hash value produced by said hash function for a plurality of second data packets is equal to a hash value produced by said hash function for a plurality of first data packets, said second data packets belonging to the same connection with the first data packets and said second data packets being destined to the opposite direction in contrast to the first data packets within the connection.

38. A computer program comprising program code for performing all the steps of claim 1 when said program is run on a computer.

39. A computer program product comprising program code means stored on a computer readable medium for performing the method of claim 1 when said program product is run on a computer.

40. A node (840) of a network element cluster for processing data packets, data packets being distributed to said node according to distribution decisions determined on the basis of certain field(s) of data packets according to predetermined criteria, said node comprising:

means (852) for processing data packets, and

means (853) for selecting at least partly arbitrary value(s) for at least one of said certain field(s) of data packets, characterized in that

said means (853) for selecting are adapted to select such value(s) for at least one of said certain field(s) of a third data packet, that distribution decisions determined according to the predetermined criteria for a plurality of first data packets and a plurality of second data packets are the same, said pluralities of first and second data packets belonging to a first set of data packets and said third data packet being related to said first set of data packets.

41. A node (840) according to claim 40, characterized in that

said means (854) for selecting are adapted to provide selected value(s) for adjusting said predetermined criteria on the basis of said selected value(s) concerning a sixth data packet, so that said a plurality of fourth data packets and a plurality of fifth data packets result in the same distribution decision, said pluralities of fourth and fifth data packets belonging to a second set of data packets and said sixth data packet being related to said second set of data packets.

42. A network element cluster (940) for processing data packets, said network element cluster comprising a plurality of nodes (840), data packets being distributed to said nodes (840) according to distribution decisions determined on the basis of certain field(s) of data packets according to predetermined criteria, and at least one of said nodes comprising:

means (852) for processing data packets, and

means (853) for selecting at least partly arbitrary value(s) for at least one of said certain field(s) of data packets as a result of processing, characterized in that

said means (853) for selecting are adapted to select such value(s) for at least one of said certain field(s) of a third data packet, that distribution decisions determined according to the predetermined criteria for a plurality of first data packets and a plurality of second data packets are the same, said pluralities of first and second data packets belonging to a first set of data packets and said third data packet being related to said first set of data packets.

43. A network element cluster (940) according to claim 42, characterized in that

said means (854) for selecting are adapted to provide selected value(s) for adjusting said predetermined criteria on the basis of said selected value(s) concerning a sixth data packet, so that said a plurality of fourth data packets and a plurality of fifth data packets result in the same distribution decision, said pluralities of fourth and fifth data packets belonging to a second set of data packets and said sixth data packet being related to said second set of data packets.

44. A node (800) of a network element cluster, said node having

means (801) for processing data packets and establishing secure tunnels in accordance with a protocol suite for securing packet data communications,

means (802) for storing hash values, which are currently allocated to said node, and

means (803) for filtering at least a plurality of data packets based on packet-specific first hash values, a first packet-specific hash value being calculated using a first hash function and first header field(s) of a data packet, said means arranged to accept only data packets having one of the hash values currently allocated to said node, characterized in that it further comprises

means (804) for filtering a plurality of second data packets, which are data packets of secure tunnel according to a protocol suite for securing packet data communications, based on second packet-specific hash values, a second packet-specific hash value being calculated using a second hash function and at least second header field(s) of a second data packet, said means arranged to accept only second data packets having one of the hash values being currently allocated to said node, and

means (805) for generating value(s) for the second header field(s), arranged to generate such value(s) that a hash value calculated using said value(s) and the second hash function is a hash value currently allocated to said node.

45. A node according to claim 44, characterized in that it further comprises

means (806) for filtering a plurality of third data packets, which are data packets in accordance with a protocol for establishing secure tunnels, based on third packet-specific hash values, a third packet-specific hash value being calculated using a third hash function and at least third header field(s) of a third data packet, said means arranged to accept only third data packets having one of the hash values currently allocated to said node,

means (807) for generating value(s) for the third header field(s), arranged to generate such value(s) that a hash value calculated using said value(s) and the third hash function is a hash value currently allocated to said node, and

means (808) for communicating information about established secure tunnels.

46. A node according to claim 45, characterized in that it further comprises

means (809) for filtering a plurality of fourth data packets, which are data packets in accordance with a protocol for establishing secure key management sessions, based on fourth packet-specific hash values, a fourth packet-specific hash value being calculated using a fourth hash function and at least fourth header field(s) of a fourth data packet, said means arranged to accept only fourth data packets having one of the hash values currently allocated to said node, and

means (810) for generating value(s) for the fourth header field(s), arranged to generate such value(s) that a hash value calculated using said value(s) and the fourth hash function is a hash value currently allocated to said node.

48. A network element cluster according to claim 47, characterized in that said at least one of said nodes further comprises

means (806) for filtering a plurality of third data packets, which are data packets in accordance with a protocol for establishing secure tunnels, based on third packet-specific hash values, a third packet-specific hash value being calculated using a third hash function and third header field(s) of a third data packet, said means arranged to accept only third data packets having one of the hash values currently allocated to said node,

means (807) for generating value(s) for the third header field(s), arranged to generate such value(s) that a hash value calculated using said value(s) and the third hash function is a hash value currently allocated to said node, and

means (808) for communicating information about established secure tunnels.

49. A network element cluster according to claim 47, characterized in that it further comprises

means 902 for monitoring the state of nodes belonging to said network element cluster, and

means 903 for reallocating the range of hash values to nodes belonging to said network element cluster.

50. A network element cluster according to claim 47, characterized in that said at least one node further comprises

means for checking if there are established secure tunnels relating to reallocated hash values, arranged to operate after reallocation of hash values,

means for deleting a secure tunnel relating to a reallocated hash value, and

means for establishing a new secure tunnel to replace a deleted secure tunnel.

47. A network element cluster (900) for processing data packets, said network element cluster comprising a plurality of nodes (800), said network element cluster having means (901) for allocating a range of hash values to the nodes, so that each node has node-specific hash values, and at least one of said nodes comprises

means (801) for processing data packets and establishing secure tunnels in accordance with a protocol suite for securing packet data communications,

means (802) for storing hash values, which are currently allocated to said node, and

first means (803) for filtering at least a plurality of data packets based on packet-specific first hash values, a first packet-specific hash value being calculated using a first hash function and first header field(s) of a data packet, said means arranged to accept only data packets having one of the hash values currently allocated to said node, characterized in that said at least one of said nodes further comprises

means (804) for filtering a plurality of second data packets, which are data packets of secure tunnel according to a protocol suite for securing packet data communications, based on second packet-specific hash values, a second packet-specific hash value being calculated using a second hash function and second header field(s) of a second data packet, said means arranged to accept only second data packets having one of the hash values being currently allocated to said node, and

means (805) for generating value(s) for the second header field(s), arranged to generate such value(s) that a hash value calculated using said value(s) and the second hash function is a hash value currently allocated to said node.